at_hash and c_hash missing in case of oidc hybrid and implicit flows

When "code id_token token" is requested we need to set at_hash and c_hash.

Also in case of "id_token token".